PT-2023-10640 · Flexera · Flexnet Manager Suite +1

Name of the Vulnerable Software and Affected Versions: FlexNet Manager Suite versions 2015 R2 SP3 and earlier FlexNet Manager Platform versions 9.2 and earlier Description: A issue exists in the inventory gathering components that can be exploited by local users to perform certain actions with...

CVE-2017-6894

CVE-2017-6894 affects FlexNet Manager Suite releases 2015 R2 SP3 and earlier and FlexNet Manager Platform 9.2 and earlier, impacting the inventory gathering components. The issue can be exploited by local users to perform actions with elevated privileges on the local system. Remediation guidance ...

GHSA-8648-H559-8H42 Fluid Components TYPO3 extension vulnerable to Cross-Site Scripting

All versions of Fluid Components before 3.5.0 were susceptible to Cross-Site Scripting. Version 3.5.0 of the extension fixes this issue. Due to the nature of the problem, some changes in your project's Fluid templates might be necessary to prevent unwanted double-escaping of HTML markup...

Fluid Components TYPO3 extension vulnerable to Cross-Site Scripting

All versions of Fluid Components before 3.5.0 were susceptible to Cross-Site Scripting. Version 3.5.0 of the extension fixes this issue. Due to the nature of the problem, some changes in your project's Fluid templates might be necessary to prevent unwanted double-escaping of HTML markup...

CVE-2023-27847

SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategoryclass and xippostsclass components...

PT-2023-21841 · Unknown · Fluid Components

Name of the Vulnerable Software and Affected Versions: fluid components extension versions prior to 3.5.0 Description: The issue allows Cross-Site Scripting XSS via a component argument parameter, specifically in certain content use cases that may be edge cases. All versions of the Fluid Componen...

CVE-2022-42948

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI...

CVE-2022-42948

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI...

CVE-2023-28818

An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and result in a customer installing unauthentic components. A malicious actor could install rogue Collector executable files aptare.jar or...

Design/Logic Flaw

An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and result in a customer installing unauthentic components. A malicious actor could install rogue Collector executable files aptare.jar or...

CVE-2023-28818

An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that could be exploited and result in a customer installing unauthentic components. A malicious actor could install rogue Collector executable files aptare.jar or...

CVE-2022-42948

Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely execute code in the Cobalt Strike UI...

What Is Cloud Architecture?

What is cloud architecture? And what types of clouds are there? Cloud architecture defines how all the components that enable cloud computing come together...

TYPO3-EXT-SA-2023-003: Cross-Site Scripting in extension "Fluid Components" (fluid_components)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2023-003...

TYPO3-EXT-SA-2023-003: Cross-Site Scripting in extension "Fluid Components" (fluid_components)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2023-003...

Privilege Escalation

github.com/kubevirt/kubevirt is vulnerable to Privilege Escalation. A remote attacker is able to compromise a specific node and wait until system-critical components with high privileges appear on its node. A compromised node can be used to elevate privileges beyond the node, potentially having...

The vulnerability of the smb2_is_status_io_timeout() function in Linux operating system-based SMB components allows a hacker to trigger a service failure.

The vulnerability of the smb2isstatusiotimeout function in Linux kernel-based SMB components is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure...

GHSA-CP96-JPMQ-XRR2 On a compromised node, the virt-handler service account can be used to modify all node specs

Impact If a malicious user has taken over a Kubernetes node where virt-handler the KubeVirt node-daemon is running, the virt-handler service account can be used to modify all node specs. This can be misused to lure-in system-level-privileged components which can for instance read all secrets on t...

Malicious code in @sok-brand-sites/common-frontend-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f4c8c64db834f3a9d141af04ecce73e9a889fadbcdb655db23b07c73e2a6145 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The Different Methods and Stages of Penetration Testing

The stakes could not be higher for cyber defenders. With the vast amounts of sensitive information, intellectual property, and financial data at risk, the consequences of a data breach can be devastating. According to a report released by Ponemon institute, the cost of data breaches has reached a...